Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service. The trim and rtrim functions stripped trailing whitespace with s/\s*$//u. Because \s* matches greedily and the $ anchor fails whenever a non-whitespace character follows the whitespace, the regex engine retries the match at each offset of a long whitespace run, producing quadratic backtracking. The fix replaces \s*$ with \s+$. Any caller that passes untrusted input to trim or rtrim can trigger CPU exhaustion with a string containing a long run of whitespace.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-07-07 | 1 | Disclosure1 |
| 2026-07-08 | 2 | Disclosure2 |
Perl CPAN CVE-2026-14895: String::Util before 1.36 are susceptible to a regular expression DoS https://www.openwall.com/lists/oss-security/2026/07/07/18
Post summary
The CVE-2026-14895 is a newly disclosed regular expression DoS vulnerability in Perl CPAN's String::Util before version 1.36, with no known exploits, patches, or active exploitation noted.
🚨*CVE* CVE-2026-14895 String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service. The trim and rtrim functions stripped trailing whitespace with … https://www.cve.org/CVERecord?id=CVE-2026-14895 ----- Traducción: CVE-2026-14895 Str… http://infoflow.cloud`
Post summary
The post announces CVE‑2026‑14895, describing a regex denial‑of‑service vulnerability in Perl’s String::Util (pre‑1.36) and provides links to the official CVE record.
CVE-2026-14895 String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service. The trim and rtrim functions stripped trailing whitespace with … https://www.cve.org/CVERecord?id=CVE-2026-14895
Post summary
The text announces CVE-2026-14895, describing a regex‑based denial of service in String::Util versions prior to 1.36 for Perl, with no details on PoC, exploits, or patches.